Merge pull request #6167 from Security-Onion-Solutions/ecs_pipeline_common

Add config for dynamically formatted ingest pipelines

salt/elasticsearch/files/ingest-dynamic/common

@@ -1,3 +1,5 @@
+{%- set HIGHLANDER = salt['pillar.get']('global:highlander', False) -%}
+{%- raw -%}
 {
   "description" : "common",
   "processors" : [
@@ -65,5 +67,16 @@
                 "index_name_format": "yyyy.MM.dd"
         }
     }
+{%- endraw %}
+{%- if HIGHLANDER %}
+    ,
+    {
+      "pipeline": {
+        "name": "ecs"
+      }
+    }
+{%- endif %}
+{%- raw %} 
   ]
 }
+{% endraw %}

salt/elasticsearch/init.sls

@@ -131,6 +131,14 @@ esrolesdir:
     - group: 939
     - makedirs: True
 
+esingestdynamicconf:
+  file.recurse:
+    - name: /opt/so/conf/elasticsearch/ingest
+    - source: salt://elasticsearch/files/ingest-dynamic
+    - user: 930
+    - group: 939
+    - template: jinja
+
 esingestconf:
   file.recurse:
     - name: /opt/so/conf/elasticsearch/ingest